Using personal data to train AI under India's DPDP Act
AI teams in India need a lawful basis for every piece of personal data a model learns from. Public data, research and consent each work differently under the DPDP Act and Rules.
QULDEX Blog
Evidence-led writing on audit, compliance and cyber governance, from the people who build audit software.
AI governance
AI system impact assessment under ISO 42001: a worked example
ISO 42001 asks you to assess how an AI system could affect people and society, not only your organisation. This worked example uses a CV-screening model.
Audit practice
Audit sampling for compliance audits: how many samples is enough?
Sample sizes for testing controls depend mainly on how often the control runs. Here are the sizes auditors commonly use, and how to handle an exception.
India compliance
CERT-In 6-hour incident reporting: a runbook for Indian companies
CERT-In's 2022 directions give most organisations in India six hours to report specified cyber incidents. That only works if the decision to report is made in the first hour.
India compliance
DPDP Rules timeline: which obligations apply when
India's DPDP Rules, 2025 phase in over 18 months. The Data Protection Board is already running; consent managers start in November 2026 and core obligations in May 2027.
AI governance
EU AI Act after the Digital Omnibus: what still applies in 2026 and what moved to 2027
The Digital Omnibus pushed the EU AI Act's high-risk rules to December 2027 and August 2028. Transparency duties did not move, and some already apply.
EU regulation
EU Cyber Resilience Act reporting has started: what software vendors must do now
Since 11 September 2026, anyone placing software or connected products on the EU market must report exploited vulnerabilities and severe incidents within 24 hours. Here is the runbook.
ISO 27001
ISO 27001 nonconformities: major vs minor, with worked examples
Whether a finding is major or minor decides whether you get certified on schedule. The difference is about the management system, not the size of the mistake.
Management systems
ISO 9001:2026 transition audits: a planning guide for certification bodies
Every ISO 9001:2015 certificate must move to the 2026 edition by 30 September 2029. For certification bodies that means three years of transition audits to schedule, staff and evidence.
NIST & CIS
NIST CSF 2.0 Govern function: what's new and how to evidence it
CSF 2.0 added Govern as a sixth function. It covers strategy, roles, policy, oversight and supply chain risk, and it is where most organisations have the least evidence.
PCI DSS
PCI DSS 6.4.3 and 11.6.1: payment page script controls explained
Two PCI DSS v4 requirements target attacks that skim card data from payment pages in the browser. Here is what each asks for, who it applies to and what assessors want to see.
India compliance
SEBI CSCRF cyber audit: what the audit covers and how often
Under SEBI's Cybersecurity and Cyber Resilience Framework, regulated entities need cyber audits by CERT-In empanelled auditors, half-yearly or yearly depending on their category.